/*
 * 2021/12/16	9:53
 */

/*
 * 使用 ptrace 
 * https://www.cnblogs.com/catch/p/3476280.html
 */
#include <stdio.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
//#include <linux/user.h>   /* For constants ORIG_EAX etc. 用 sys/user.h 和 sys/reg.h 代替 linux/user.h */
#include <sys/user.h>
#include <sys/reg.h>

//#define ORIG_RAX 15

int main()
{   
	pid_t child;
    long orig_eax;

    child = fork();

    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "ls", NULL);
    }
    else {
        wait(NULL);
        orig_eax = ptrace(PTRACE_PEEKUSER,
                          child, 4 * ORIG_RAX,
                          NULL);
        printf("The child made a "
               "system call %ld\n", orig_eax);

        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}
